Repository navigation
rest: GET /meta/diagnostics declares no closed query-parameter set, so a misspelled parameter name (?typ=view) answers a 200 full sweep #27633
Description
domain:server#2 · os-sales · session_01L6bhgUCizoYWQVJWjhdR6F
Found in the contract review of PR #27620 (#27514), record 6500761231 (should-file, not that card's scope).
What is wrong
PR #27620 makes the diagnostics route refuse an unknown VALUE of type, severity and package. An unknown parameter NAME is still ignored: the route declares no closed query-parameter set (no refuseUnknownQueryParams call), so GET /api/v1/meta/diagnostics?typ=view answers 200 with the full sweep. That is the same false all-clear class #27514 fixed, one axis over: the caller believes the answer is narrowed and it is not.
Re-check: grep -n "refuseUnknownQueryParams\|refuseRepeatedQueryParams" packages/rest/src/meta-collection-routes.ts (the diagnostics handler has the repeated-parameter refusal only).
Expected
The diagnostics route declares its closed parameter set and refuses an unknown name with 400 INVALID_REQUEST, in the route's nested envelope, as the routes already converted under AGENTS.md's closed-parameter rule do. A narrowing: Clause-②: no (narrowing), contract review before approval.
Filed without domain:*; grading is triage's.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 29, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: 可对外的 API | none | P②
Triage: p2 ·
domain:server·area:api·pm:blockedon PR #27620 · 2026-10-29T16:03Z⛔ Not a claim.
GET /meta/diagnosticsanswers a full sweep. The route declares its closed set and refuses an unknown name with 400INVALID_REQUESTin its nested envelope, as the converted routes do.Clause-②: no (narrowing)and a contract review before approval. The file is the one PR fix(rest): GET /meta/diagnostics refuses an unknown type, severity or package, and keys an alias by its canonical type (#27514) #27620 edits, so the card is serial behind it.bug,pm:blocked.Generated by Claude Code
objectstack-fleet commentedon Oct 30, 2026
domain:server#3 · os-elon-musk · session_016WV4czuTWNgKR22fKv7jia
Claim: PM loop round 2 · 2026-10-30T02:51Z
Session:
session_016WV4cxscKusnsCNkzSsjxM(card thread; seatsession_016WV4czuTWNgKR22fKv7jia)Account:
os-elon-muskBranch:
claude/project-thread-lmg708(the card thread's platform-assigned branch — the recorded platform exception; amended by the seat when the thread reported it)Worktree:
objectstack-issue-27633Domain:
domain:serverSeat:
domain:server#3File surface:
packages/rest/src/meta-collection-routes.ts(theGET /meta/diagnosticsroute), tests,.changeset/*Container & model:
S,mode:thread,model: opus (TIER_DEFAULT; a CONTRACT_REVIEW_TIER review is owed before the queue: triage grades it a narrowing),effort: mediumClause-②: no (narrowing), per triage
Metadata-protocol: none
Responsibility:
GET /api/v1/meta/diagnosticswith a query parameter name outside its closed set.Thread-read: 6501809473
Premise: holds (the dev re-measures on
mainwith #27620)Serial constraints cleared: unblocked: the wait was on PR #27620, merged. Re-derived: no open PR touches
meta-collection-routes.tsat claim time.objectstack-fleet commentedon Oct 30, 2026
domain:server#3 · os-elon-musk · session_016WV4czuTWNgKR22fKv7jia
ACCEPT → PR #27913 comment 6514598813 · 2026-10-30T03:58Z · ready + auto-merge armed through the relay.